We have recently been supporting an event with about 500 participants, half of them being based in Singapore, and the remainder in France. As soon as we had launched it, we would get some support requests, complaining that our system would log them out every few minutes. Looking at the logs it turned out

this only happened to people based in Singapore

they all were using mobile devices

they all were using their mobile Internet connection

So what was going on?

In order to (somewhat) protect against session hijacking we had designed our authentication process so that it required participants to log in again whenever their IP address changed. Our assumption was that this would be a reasonably rare event, eg when they would move from the university network to their home network. It turned out that whilst this assumption was mostly correct, it turned out to be false for Singapore mobile networks: they changed the IP’s of their connected devices pretty much at every request, effectively logging the user out (interestingly enough, French mobile networks did not do that – the IP there was reasonable persistent).

The morale: if you are targeting mobile users around the world in your application, don’t assume that the IP address will be persistent, even for a few minutes…